Zero-day vulnerabilities (security flaws that are unknown or unpatched by software vendors) are fuelling some of the highest-stakes debates in cybersecurity today. Recent examples like the SharePoint server zero-day vulnerability highlight the tension: should bugs be immediately disclosed to the public to protect the many, or kept secret for research, corporate, or national security reasons? As zero-days grow increasingly valuable and dangerous, how we decide to handle them will shape the future of digital trust, safety, and warfare.

Sitting in the crossfire are operators of critical infrastructure: hospitals, utilities, energy- and transportation networks. For them, disclosure timing can spell the difference between business-as-usual and catastrophic shutdown or even loss of life.

Then there are government agencies, who seem have developed a love/hate relationship with zero-days, stockpiling them for defence and intelligence purposes while simultaneously encouraging transparent and responsible disclosure for everyone else.

Finally, there are the businesses who rely on the aforementioned vendors, individuals whose data is processed by these businesses, researchers, and the ever-present crowd of legal advisors and cyber insurers trying to keep up.

Current disclosure practices vary widely, ranging from coordinated disclosure (i.e., waiting for a vendor patch before making a vulnerability public) to government stockpiling of zero-days, to outright black-market sales. The question of how zero-days should be handled is not just about patching code or racking up bounty checks – it comes down to striking a delicate balance between the conflicting interests of all stakeholders.

Gone are the days when disclosure debates were confined to cybersecurity mailing lists. For example, the United States’ Vulnerabilities Equities Process (VEP) made waves by trying to arbitrate what the government must disclose vs. what it can quietly keep. Across the Atlantic, GDPR and other EU regulations require prompt data breach notifications to respective authorities. Meanwhile, China, Russia, and a handful of other states have been fingered for cultivating zero-day stockpiles.

Big Tech has its own spin: Google’s Project Zero and Microsoft’s bug bounty platforms set the tone for coordination between government authorities, vendors, and ethical hackers, but even here, timing, tone, and follow-through vary widely. Despite international standards promoting Coordinated Vulnerability Disclosure (CVD), policy consistency is still uncommon, resulting in a patchwork of overlapping, often contradictory rules and guidance.

Immediate disclosure can put defenders on the front foot (after all, how are security teams supposed to patch a vulnerability if they are not aware that it exists). The problem though, is that disclosure is also likely to tip off attackers, raising the risk of mass exploitation. Keep things under wraps, however, and trust can be eroded when flaws are eventually outed by journalists or adversaries. Add to this the growing financial incentives around vulnerabilities (bug bounties or exploit resale on the black market) and policy makers are left to navigate a truly complex ethical and legal environment.

As the zero-day market heats up and AI tools turbocharge both attackers and defenders, organisations are left scrambling to manage risk, protect reputations, and keep up with increasingly sophisticated adversaries.

Timing is everything in the zero-day lifecycle, adding a further layer of complexity:

There are three major approaches to disclosure – responsible, full, and coordinated – each bringing its own pros and cons. Responsible disclosure is the industry darling: it buys vendors time before the big reveal, hopefully keeping attackers in the dark. Full disclosure, on the other hand, throws it all out there, prioritising transparency and forcing quick action, sometimes at the expense of user safety. Coordinated disclosure tries to strike a balance – managed handoffs between researchers, vendors, and authorities – though it can quickly devolve into a communications juggling act.

Governments and intelligence agencies have an interest in keeping some zero-days undisclosed in the name of national security or cyber operations. But what if an adversary independently stumbles onto the same bug? The delayed fix (which may have come earlier if vendors were made aware of the vulnerability) could mean open season for criminals and spies alike, thereby endangering the public. The ethical tightrope is real, and public safety doesn’t always come out on top.

Selling zero-days can be lucrative, especially on the darker corners of the internet. While bug bounty programs offer a legitimate (though admittedly less lucrative) route, not every white-hat gets the recognition or reward they feel they deserve. Sales to brokers and third parties with unclear end users dwell in a legal and ethical haze, pushing some toward shady deals despite best intentions.

The industry holds up documentation and clear communication with vendors to minimise harm and protect end users as best practices. At the same time however, we all know that the media is prone to putting individual recognition and publicity above the collective good and community safety. As a result, publicity-driven leaks are still all too common.

The zero-day disclosure debate remains as unresolved as it is essential. Balancing transparency, public protection, researcher motivation, and national priorities is a difficult, moving target. No single policy can reconcile all interests – but that doesn’t mean clarity, coordination, and coherence are impossible. What is needed now is honest collaboration and alignment between industry, governments, and the research community. In the meantime, organisations should brace for an era where zero-days are part of everyday security calculus and where disclosure practices remain in flux.